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SUMMARY 

Increasing attention is being given to the problem of erroneous measurement data 
for multisensor navigation systems. A recursive estimator can be used in conjunction 
with a "snapshot" batch estimator to provide fault detection and isolation (FDI) for these 
systems. A recursive estimator uses past system states to form a new state estimate and 
compares it to the calculated state based on a new set of measurements. A "snapshot" 
batch estimator uses a set of measurements collected simultaneously and compares 
solutions based on subsets of measurements. The "snapshot" approach requires 
redundant measurements in order to detect and isolate faults. FDI is also referred to as 
Receiver Autonomous Integrity Monitoring (RAIM). 


BACKGROUND 

The objective is to detect and isolate sensor malfunctions which cause 
unacceptably large position errors using only inconsistency in the measurement data. 
Previously, FDI has been successfully applied to redundant inertial navigation systems 
(refs. 1-3). However, FDI can be used for any multisensor navigation system, including, 
systems based on the Global Positioning System (GPS), Long Range Navigation (Loran- 
C) and the Global Navigation Satellite System (GLONASS). 

A recursive estimator, such as the Kalman filter, uses the history of the user 
navigation state to form a predicted state estimate. If the difference between the 
predicted state estimate and the calculated state (based on a new set of measurements) 
is too large, a fault is declared. This approach is excellent for detecting step errors or 
rapidly growing ramp errors, and requires no redundant measurements. However, if a 
measurement ramp error with a small slope enters the system (caused by for instance an 
uncorrected clock drift in a GPS satellite), the Kalman filter may "smooth" the data 
rather than declare a fault. To solve this problem, a batch estimator is used since it does 
not depend on the history of the user state. 

The "snapshot" batch estimator is based on a least squares solution which requires 
at least one redundant measurement for detection, and at least two redundant 
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measurements for isolation. Solutions calculated based on subsets of measurements can 
be compared to determine if inconsistency exists. Once a fault is declared, isolation is 
accomplished by applying detection techniques to subsets formed by leaving out one 
measurement at the time. This procedure is successful if no fault is found when the 
faulty measurement is omitted and a fault is declared for each subset containing the 
erroneous measurement. The focus of the remainder of this paper is on the 
characterization of "snapshot" batch estimators to perform FDI. 


LEAST SQUARES FAULT DETECTION 

One of the main input parameters to the fault detection algorithm is the alarm 
threshold, defined as the allowable horizontal radial error in the calculated user position. 
The ideal case would be to raise a flag only when this limit is exceeded and never raise a 
flag otherwise. However, since fault detection is performed in the presence of 
measurement noise and in a domain other than the solution space, it is only possible to 
detect a fault with a certain probability. Therefore, two undesirable events are possible - 
a false alarm and a missed detection. Two major parameters used in characterizing the 
performance of the fault detection algorithm are the probability of a false alarm (P FA ) 
and the probability of a missed detection (P MD ). As one might assume, it is desirable for 
these probabilities to be very small. 

A fault is declared when a detection statistic exceeds a certain detection threshold 
(T d ). Two cases of a ramp error are shown in figure 1. In case I, T D is breached before 
the alarm threshold is crossed, causing a false alarm. As the position error grows, the 
false alarm becomes a correct alarm. In case II, the alarm threshold is exceeded before 
the detection threshold is exceeded, resulting in a missed detection. Eventually T D is 
crossed, causing a flag to be raised for a correct alarm. The normal operating state 
includes all circumstances where neither threshold is exceeded. For multisensor systems, 
this state should have a large probability of occurrence. 


FAULT DETECTION ALGORITHM 

A least squares approach can be used for fault detection. The linear relationship 
between the measurements and the user state is given by: 

y = H £ (1) 

where: y = measurement vector 

6 = user state vector 
H = data matrix 

The dimension of H is n-by-m, where n is the number of measurements and m is 
the dimension of the user state vector. The user state vector 6 consists of the user 
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position coordinates and other navigation state elements such as clock offset with respect 
to, for instance, GPS time, as required by the navigation solution. 

Three cases exist: 


1) n < m : Underdetermined system 

2) n = m : Exactly determined system 

3) n > m : Overdetermined system 

Algorithms for managing the redundant measurements in case 3, an overdetermined 
system, form the basis of fault detection. In the presence of redundant signals, a parity 
equation can be derived from equation (1). First, a QR factorization is performed on 
the data matrix H (ref. 4): 

H = QR ( 2 ) 

This factorizes H into an orthogonal matrix Q (Q T Q = I) and an upper triangular matrix 
R. R contains (n-m) rows of zeros, reflecting that H includes data from redundant 
measurements. Substituting equation (2) for H in equation (1) yields: 

y. = QR& 

Q T y = Q t QR& ( 3 ) 

Q T y = R& 


Let R be partitioned into an m-by-m upper triangular matrix U and (n-m) rows of zeros, 
denoted by 0. Partition Q T conformably into Q, and Q 2 . 
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The least squares solution is given by: 

M = u-'Q# 


(5) 


Note that U is nonsingular due to the way R is partitioned. The parity equation is: 

Q 2 y = 0 (6) 


Since y contains measurement errors such as noise (e) and measurement biases (b), a 
parity vector (p) can be defined as (replace y by y + e + b): 
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r = Q 2 y + Q 2 £ + <? 2 ^ 
r = Q 2 s. + Q 2 h 


( 7 ) 


Although the measurement noise and bias errors are not known, their components in 
parity space are given by equation (7). The parity vector can be used as a detection 
function for declaring faults. 


PARITY SPACE AND ESTIMATION SPACE 

As an example, consider a scenario where one redundant measurement is 
available. In this case, the parity vector becomes a scalar. The detection statistic is 
given by |p| , which is assumed to be normally distributed. Figure 2 shows the 
distribution of p when no bias exists in any of the measurements. A fault is declared 
when the detection threshold (T D ) is exceeded. Note that integrating the area under the 
tails outside T D yields the probability of a false alarm in parity space. 

Figure 3 illustrates the existence of a bias in one of the measurements. The 
distribution of the detection statistic p is shifted over, and the area under the curve 
within the limits of T D is the probability of a missed detection in parity space. 

If an alarm is raised in parity space, it can either be a correct alarm or a false 
alarm in estimation space. If no alarm is raised in parity space, it can either be normal 
operation or a missed detection in estimation space. Thus, the definitions of a false 
alarm and a missed detection are slightly changed. References 5 and 6 contain a detailed 
explanation of the relation between parity space and estimation space. 


FAULT ISOLATION CONCEPTS 

Let n be the number of available measurements. Then k detection functions are 
formed (k = l,...,n;one for each measurement), and an alarm is raised if any |d k | > 
T D . Once alarm status has been reached, the next step is to attempt isolation. At least 
two redundant measurements are required for this. The process uses the fault detection 
algorithm applied to all subsets created by leaving out one measurement at the time. By 
omitting the failed measurement, the detection functions for that subset should all lie 
within T d . By omitting a healthy measurement, at least one detection function should 
exceed T D . 

The number of detection functions used for isolation is n(n-l). Let d m k be the 
detection function for the k* satellite with satellite m omitted (note that k=m does not 
exist). Successful isolation occurs when: 
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1) If m = failed satellite, all | d m k | < T D 
and 2) If m * failed satellite, at least one | d mk | > T D 

Figure 4 shows the fault detection and isolation state diagram. From the diagram, 
it can be seen that the probability of a false alarm should be very small, because it 
results in either removing a healthy measurement or in system unavailability. The latter 
is very undesirable for a sole means of navigation system. Furthermore, the probability 
of a wrong isolation should also be minimized. The goal of the current research is to 
define the transitional probabilities of the state diagram given the required state 
probabilities for navigation systems. 


CONCLUSIONS 

A fault detection and isolation algorithm is presented for use in a multisensor 
navigation system. A state diagram has been developed which incorporates all important 
system states for the FDI process. Efforts continue on the quantification of state 
transition probabilities such that navigation system requirements for fault detection and 
isolation can be satisfied. 
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HORIZONTAL RADIAL POSITION ERROR 



FAULT DETECTION STATISTIC 


Figure 1 . Example of the impact of slowly growing measurement errors on fault 

detection. 



Figure 2. Probability Density Function for p - no measurement bias. 
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Figure 3. Probability Density Function for p - with measurement bias. 



MD = Missed Detection 
FA = False Alarm 
CA = Correct Alarm 
FI = False Isolation 
W1 = Wrong Isolation 


Cl = Correct Isolation 


Figure 4. Fault Detection and Isolation State Diagram. 
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